Insertion of Sensitive Information into Log File

Overview apache-airflow-task-sdk is a The Apache Airflow Task SDK includes interfaces for Dag authors and Task execution logic for Python. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File which had masksecret applied. The DAG run logs UI exposes...

CVE-2026-4810

CVE-2026-4810 is a Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) affecting Python OSS, Cloud Run, and GKE. Affected ADK versions range from 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2), where an unauthenticated remote attacker can execute arbitr...

GHSA-479C-33WC-G2PG React Server Components have a Denial of Service Vulnerability

Impact A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack versions 19.0.0, 19.1.0 and 19.2.0. The vulnerability is triggered by sending specially crafted HTTP requests...

PT-2026-26200

Name of the Vulnerable Software and Affected Versions Socket.IO versions prior to 3.3.5 Socket.IO versions 3.3.5 through 3.4.4 Socket.IO versions 4.0.0 through 4.2.6 Description Socket.IO is a real-time, bidirectional, event-based communication framework. A specially crafted Socket.IO packet can...

EulerOS Virtualization 2.10.1 : python-urllib3 (EulerOS-SA-2026-1545)

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP...

GHSA-PHC3-FGPG-7M6H Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS

Impact This is an uncontrolled resource consumption vulnerability CWE-400 that can lead to Denial of Service DoS. In vulnerable Undici versions, when interceptors.deduplicate is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An...

GHSA-XJ37-QJG2-XWV2 @whyour/qinglong: manipulation of the argument command leads to protection mechanism failure

A security vulnerability has been detected in whyour qinglong up to 2.20.1. Affected is an unknown function of the file back/loaders/express.ts of the component API Interface. The manipulation of the argument command leads to protection mechanism failure. The attack may be initiated remotely. The...

CVE-2026-3381 affecting package zlib for versions less than 1.3.2-1

CVE-2026-3381 affecting package zlib for versions less than 1.3.2-1. An upgraded version of the package is available that resolves this issue...

External Control of File Name or Path

Overview mcp-atlassian is a The Model Context Protocol MCP Atlassian integration is an open-source implementation that bridges Atlassian products Jira and Confluence with AI language models following Anthropic's MCP specification. This project enables secure, contextual AI interactions with...

CVE-2025-38639 affecting package kernel for versions less than 5.15.200.1-1

CVE-2025-38639 affecting package kernel for versions less than 5.15.200.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-39681 affecting package kernel for versions less than 5.15.200.1-1

CVE-2025-39681 affecting package kernel for versions less than 5.15.200.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-38695 affecting package kernel for versions less than 5.15.200.1-1

CVE-2025-38695 affecting package kernel for versions less than 5.15.200.1-1. An upgraded version of the package is available that resolves this issue...

PT-2026-23093

Name of the Vulnerable Software and Affected Versions jackson-core versions 3.0.0 through 3.0.x Description jackson-core contains core low-level incremental "streaming" parser and generator abstractions. The UTF8DataInputJsonParser and ReaderBasedJsonParser bypass the maxNestingDepth constraint...

Linux Distros Unpatched Vulnerability : CVE-2026-27204

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of WASI host interfaces are...

CVE-2026-27204

CVE-2026-27204 involves Wasmtime’s WASI host interfaces, where guest code could exhaust host resources due to insufficient limits on resource allocations. Affected versions prior to fixes include 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0. The fixes are released in Wasmtime 24.0.6, 36.0.6, 40.0.4...

CVE-2026-27204 Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of WASI host interfaces are susceptible to guest-controlled resource exhaustion on the host. Wasmtime did not appropriately place limits on resource allocations requested...

CVE-2025-71084 affecting package kernel for versions less than 6.6.121.1-1

CVE-2025-71084 affecting package kernel for versions less than 6.6.121.1-1. An upgraded version of the package is available that resolves this issue...

Security Bulletin: IBM Engineering Lifecycle Management - Jazz Foundation is impacted by vulnerabilities in Apache PDFBox

Summary Vulnerabilities have been identified in Apache PDFBox, which is used in IBM Engineering Lifecycle Management - Jazz Foundation. Vulnerability Details CVEID:CVE-2021-27807 DESCRIPTION: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apac...

CVE-2023-25178

Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning...

XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as...